CVE-2022-25921

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	morgan-json	< unspecified

References

https://github.com/indexzero/morgan-json/blob/3a76010215a4256d41687d082cd66c4f00ea5717/index.js%23L46Broken Link
https://security.snyk.io/vuln/SNYK-JS-MORGANJSON-2976193Exploit, Third Party Advisory
https://github.com/indexzero/morgan-json/blob/3a76010215a4256d41687d082cd66c4f00ea5717/index.js%23L46Broken Link
https://security.snyk.io/vuln/SNYK-JS-MORGANJSON-2976193Exploit, Third Party Advisory

Timeline

Published: Aug 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-259229.1Power Line Communications PLC4TRUCKS J2497 trailer brake controllers implement diagnostic functions which can be invoked by replaying J2497 CVE-2022-259239.8Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper u CVE-2022-259267.8Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input san CVE-2022-259277.5Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial CVE-2022-259295.4The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in s CVE-2022-25937.2The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL quer CVE-2022-259317.5All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being emplo CVE-2022-259329.8The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes are incomplete. An a CVE-2022-259367.5Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable.CVE-2022-259376.5Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root di CVE-2022-25948.8The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated CVE-2022-259407.5All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control ch